release: v0.12.0

[bolens]

Summary

• Release LaunchLayer 0.12.0 with TUI parity improvements
• Merge and preserve the local security, runtime, hub, and CI hardening commits
• Update compatible hub dependencies and patch all known npm advisories
• Update versioned docs and changelog

Test plan

• make check-all
• make check-version
• pnpm audit reports zero vulnerabilities
• ./launchlayer --version reports 0.12.0

[Copilot]

Pull request overview

This PR cuts the LaunchLayer v0.12.0 release by updating the CLI version + docs/changelog, hardening supply-chain and runtime behaviors, and tightening hub security/retention with bounded cleanup jobs and improved request identity handling.

Changes:

• Harden runtime teardown and state restoration (CPU/network tuning, PipeWire quantum) and improve launch hook failure handling + logging.
• Add CI + local gates for supply-chain integrity (pinned GitHub Action SHAs, pinned hub deps, lockfile integrity hashes) and strengthen backup/import/export safety.
• Improve hub security and operability (ingress-trusted client identity + HMAC’d identifiers, bounded queries, retention cleanup cron + tests) and update hub dev tooling/coverage thresholds.

Reviewed changes

Copilot reviewed 50 out of 52 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/unit/runtime.bats	Adds unit coverage for saving/restoring CPU + network tuning state.
test/unit/runtime-tuning.bats	Updates PipeWire restore test to use state file semantics + XDG_STATE_HOME isolation.
test/unit/runtime-exit.bats	Ensures runtime tuning restore is part of launch exit teardown sequence.
test/unit/inject-extras.bats	Updates inject fetch tests for required SHA-256 and new fetch semantics.
test/unit/dependency-pins.bats	Adds unit tests for the new dependency/action pin enforcement script.
test/unit/config.bats	Adds tests for comment parsing inside quotes, indented INCLUDE support, and symlink escape rejection.
test/unit/backup.bats	Adds tests for rejecting unsafe tar members (links) and enforcing expanded-size limits.
test/integration/cli.bats	Adds integration regression for post-launch hook failure still recording final state; bumps version assertion.
test/integration/backup-archive.bats	Verifies export archive permissions, import dry-run behavior, and updates local.env key usage.
test/helpers.bash	Isolates XDG_STATE_HOME for integration tests and cleans it up on teardown.
scripts/check-dependency-pins.sh	Introduces supply-chain gate for pinned Action SHAs and exact/integrity-checked hub dependencies.
README.md	Documents hub rate limiting fail-closed setup and adds make check-dependency-pins.
Makefile	Adds check-dependency-pins target and includes it in make check.
lib/vram.sh	Extends stale-launch and exit cleanup to restore PipeWire + runtime tuning state.
lib/tui/config.sh	Updates TUI key help text to reflect required SHA-256 for remote inject downloads.
lib/runtime/tuning.sh	Adds persisted restore for CPU/network tuning and makes PipeWire restore state-file driven.
lib/runtime/inject.sh	Requires SHA-256 for remote downloads and switches to temp-download + atomic move semantics.
lib/launch.sh	Makes teardown unconditional for non-dry runs and treats pre/post launch hook failures explicitly.
lib/inspect/backup/import.sh	Hardens tar safety checks (type/path/size/member count), validates staged env files, and installs atomically with rollback.
lib/inspect/backup/export.sh	Writes exports with umask 077, atomic temp output, and chmod 600.
lib/hardware/cpu.sh	Makes state cache writes best-effort to tolerate read-only/unwritable state directories.
lib/config.sh	Improves env parsing: comment stripping outside of quoted values; strengthens INCLUDE resolution via portable realpath/py fallback.
lib/cli.sh	Bumps LAUNCHLAYER_VERSION to 0.12.0.
hub/vitest.config.ts	Enables coverage reporting with thresholds for hub tests.
hub/pnpm-workspace.yaml	Pins patched transitive overrides to specific versions.
hub/pnpm-lock.yaml	Updates lockfile to match pinned dependencies + added coverage dependency.
hub/package.json	Pins exact dependency versions and adds test:coverage script.
hub/convex/schema.ts	Adds indexes to support bounded cleanup queries and config dedup cleanup.
hub/convex/rate_limits.ts	Adds internal mutation for bounded cleanup of expired operational records with rescheduling.
hub/convex/rate_limits.test.ts	Adds tests for cleanup behavior and rescheduling when batch is full.
hub/convex/machines.ts	Bounds similar-machine candidate selection to prioritize recent rows.
hub/convex/lib/rate_limit.ts	Switches to ingress-trusted identity header + HMAC-hashed identifiers; adds retention constants.
hub/convex/lib/rate_limit.test.ts	Updates tests for new trusted header + HMAC identifier behavior and config fail-closed checks.
hub/convex/lib/http_body.ts	Adds utf8ByteLength helper for accurate body-size enforcement.
hub/convex/lib/http_body.test.ts	Adds regression test for utf8ByteLength with non-BMP characters.
hub/convex/http.ts	Uses utf8 byte length for body limits, adds OPTIONS CORS preflight, and awaits async identifiers.
hub/convex/http.test.ts	Adds CORS preflight test + updates routes to include trusted client header configuration.
hub/convex/crons.ts	Adds daily cron to clean expired operational rows.
hub/convex/configs.ts	Bounds candidate queries/history fetches and schedules download-dedup cleanup on delete.
hub/convex/configs.test.ts	Adds coverage for dedup cleanup scheduling and newest-candidate prioritization caps.
hub/.env.example	Documents new ingress-trusted identity + HMAC key environment variables.
docs/tui.md	Updates documented TUI header version string to 0.12.0.
docs/cli.md	Updates inject SHA-256 documentation to “required for remote fetches”.
docs/architecture.md	Documents new hub identity/HMAC + retention model and adds check-dependency-pins to validation section.
CHANGELOG.md	Adds 0.12.0 release notes and updates compare links.
AGENTS.md	Adds repository contribution/review guidance document.
.gitignore	Ignores coverage output and Python cache artifacts.
.github/workflows/ci.yml	Adds supply-chain job (pins check + gitleaks), SHA256-verifies actionlint download, and requires supply_chain in final CI gate.
.github/workflows/ci-shell.yml	Adds portability job running a platform-sensitive Bats subset on Ubuntu + macOS.
.github/workflows/ci-hub.yml	Adds hub test:coverage matrix task.

Files not reviewed (1)

• hub/pnpm-lock.yaml: Generated file

Suppressed comments (4)

lib/runtime/tuning.sh:56

• If writing the network tuning state file fails (read-only state dir, full disk, etc.), the function currently aborts under set -e. This should fail gracefully so a tuning opt-in can't take down the launch path.
  lib/runtime/tuning.sh:116
• apply_network_tuning applies sysctl/ethtool changes even if the pre-state can't be saved. If saving state fails, it should skip applying tuning to avoid leaving the host in a modified state that can't be restored.
  lib/runtime/tuning.sh:163
• apply_pipewire_low_latency sets the PipeWire quantum before ensuring the state file can be written. If $STATE_DIR is not writable, this can leave the host tuned without any way to restore it on exit.
  lib/runtime/tuning.sh:192
• apply_cpu_performance always runs by default (GAME_PERFORMANCE defaults to 1) and currently does mkdir -p "$STATE_DIR" under set -e. If the state dir can't be created, the entire launch will abort instead of skipping the optional tuning.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.